CVE-2026-76403: The software does not validate, or incorrectly validates, a certificate. in Splunk Splunk Connect for Kafka

In Splunk Connect for Kafka versions >=2.2 and <2.2.7, the Kerberos authentication mechanism used with HTTP Event Collector fails to correctly validate certificates. This improper validation enables an unauthenticated network attacker to intercept and alter data transmitted by the connector. The vulnerability stems from the Kerberos authentication path not enforcing the configured certificate validation settings when building the HTTP client, exposing sensitive data to potential compromise.

An unauthenticated attacker on the network path can read or modify all data sent from Splunk Connect for Kafka to the HTTP Event Collector when Kerberos authentication is enabled. This compromises confidentiality and integrity of the data transmitted by the connector. There is no indication of availability impact. No known exploits are reported in the wild.

A fix is available in Splunk Connect for Kafka version 2.2.7 and later. Users should upgrade to version 2.2.7 or newer to remediate this vulnerability. Until upgraded, users should consider the risk of data interception or alteration when using Kerberos authentication with HTTP Event Collector. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.